NV ELMAR listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Aruba
• Sector: Energy & Utilities
• Announcement date: September 20, 2025

Qilin ransomware group targets NV ELMAR

The Qilin ransomware group has published a leak announcement targeting NV ELMAR, a major utility provider in Aruba. The announcement, which appeared on the group's dedicated leak site on September 20, 2025, indicates a targeted cyberattack against the organization. While the group has made public claims regarding the breach, the incident highlights the ongoing risks faced by critical infrastructure providers in the region.

The Qilin group has officially listed the institution on its leak site, marking a significant escalation in their campaign against the organization. This type of public listing is a common tactic used by ransomware groups to pressure victims into meeting specific demands. In this instance, the group has taken the step of publicly naming the entity to signal that the breach has occurred.

Claims of management failures and stolen files

In the announcement posted by the Qilin group, the attackers have not only claimed to have breached the network but have also directed criticism toward the institution's management processes. The group asserts that they have obtained thousands of files during their operation. This claim suggests a significant volume of data may have been compromised during the intrusion.

The group's motivation, as expressed in their announcement, appears to involve targeting the internal administrative and management structures of the organization. By criticizing the institution's processes, the group attempts to undermine the credibility of the entity's governance while simultaneously advertising their success in exfiltrating data.

Details regarding the leaked data

Despite the group's claims of possessing a large volume of information, specific details regarding the exact content of the leaked data have not been provided. The group has mentioned that they have obtained thousands of files, yet they have not specified the nature or the categories of these files.

The leak site announcement included a screenshot that prominently displayed the institution's logo, confirming the target of the attack. However, the actual content of the files within that screenshot has been blurred, leaving the specific details of the stolen information unknown. The listing names no specific data types that have been compromised.

Common ransomware tactics

Ransomware groups often employ double-extortion tactics, a method where the attackers not only encrypt an organization's data but also steal sensitive information. This allows them to threaten the public release of the data if the ransom is not paid, creating a second layer of pressure on the victim. This tactic is particularly effective against organizations that cannot afford the operational downtime caused by encryption but are highly sensitive to the reputational damage caused by data leaks.

Organization profile and sector risks

NV ELMAR is the sole electricity distribution and supply company for the island of Aruba. The organization holds a critical role in the region, as it is responsible for the transmission, distribution, and customer service of electrical energy across the entire island. Because of this monopoly on essential services, the organization is considered part of the critical infrastructure sector.

The potential impact of such an incident in the energy sector is significant. A breach of this nature can raise serious concerns regarding the reliability of public services in the region. Furthermore, the leakage of institutional data may lead to the exposure of sensitive personal information belonging to employees or customers, creating long-term privacy risks for the population of Aruba.

Analysis and implications for critical infrastructure

The targeting of an entity like NV ELMAR by a group known for double-extortion tactics poses substantial risks to operational continuity. For critical infrastructure providers, the threat is twofold: the immediate disruption of services and the long-term exposure of sensitive data. Such incidents can create a foundation for secondary attacks, where stolen data is used for further exploitation or social engineering.

To mitigate these risks, organizations in the energy and utility sectors often implement various defensive measures. These include robust network segmentation to prevent lateral movement, continuous monitoring of network traffic to detect unauthorized data exfiltration, and strict access controls to limit the exposure of sensitive files. Furthermore, maintaining comprehensive backups and conducting regular incident response drills are essential steps for ensuring that operational continuity can be maintained even in the event of a successful breach.